CVE-2026-32031: OpenClaw auth bypass

CISO Take

OpenClaw versions prior to 2026.2.26 contain an authentication bypass in the plugin channel gateway caused by a path canonicalization mismatch between the route guard and plugin handler — an unauthenticated network attacker can reach protected plugin APIs by sending requests with alternative path encodings such as percent-encoded slashes or dot-segment variants. Despite a medium CVSS of 4.8, this CVE sits in the top 91st EPSS percentile, meaning real-world exploitation attempts are substantially more probable than the base score implies. The risk is amplified by OpenClaw's documented ecosystem exposure: AIID incident #1368 confirmed the same plugin infrastructure was actively abused in early 2026 to deliver credential-stealing malware, establishing clear adversarial interest in this attack surface. Teams running OpenClaw should prioritize upgrading to 2026.2.26 immediately; until patched, restrict plugin channel API endpoints at the network perimeter and audit access logs for requests containing encoded path segments targeting these routes.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Practical risk exceeds the headline CVSS 4.8. EPSS top-91st-percentile signals exploitation probability already higher than 91% of all CVEs. High attack complexity (AC:H) is partially offset by zero privileges required and full network accessibility. AI agent deployments are high-value targets — plugin channel APIs frequently expose code execution environments, secret stores, or credential-bearing tool integrations. With 396 prior CVEs in this package and documented ecosystem abuse per AIID #1368, defenders should treat this as high operational priority despite the moderate severity classification.

How does the attack unfold?

Reconnaissance

Attacker identifies a public-facing OpenClaw server-http instance and enumerates plugin channel API endpoint paths via documentation, OpenAPI specs, or prior scanning.

AML.T0006

Authentication Bypass

Attacker crafts HTTP requests to plugin channel endpoints using alternative path encodings (percent-encoded slashes, dot-segments) that the gateway guard fails to match, bypassing authentication while the plugin handler still routes the request normally.

AML.T0049

Plugin API Enumeration

Unauthenticated access to protected plugin channel APIs is achieved; attacker enumerates available agent tool definitions, connected integrations, and configuration parameters.

AML.T0084.001

Tool Invocation and Impact

Attacker invokes agent tools via the compromised plugin API to read sensitive data, trigger automated workflows, or exfiltrate credentials stored in tool configurations.

AML.T0053

Reconnaissance

Attacker identifies a public-facing OpenClaw server-http instance and enumerates plugin channel API endpoint paths via documentation, OpenAPI specs, or prior scanning.

AML.T0006

Authentication Bypass

Attacker crafts HTTP requests to plugin channel endpoints using alternative path encodings (percent-encoded slashes, dot-segments) that the gateway guard fails to match, bypassing authentication while the plugin handler still routes the request normally.

AML.T0049

Plugin API Enumeration

Unauthenticated access to protected plugin channel APIs is achieved; attacker enumerates available agent tool definitions, connected integrations, and configuration parameters.

AML.T0084.001

Tool Invocation and Impact

Attacker invokes agent tools via the compromised plugin API to read sensitive data, trigger automated workflows, or exfiltrate credentials stored in tool configurations.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I Low

A None

What should I do?

5 steps

Patch immediately: upgrade to OpenClaw 2026.2.26 or later, which resolves the path canonicalization mismatch in the gateway guard.
Workaround if patching is delayed: deploy a WAF or reverse proxy rule to normalize and canonicalize URL paths before forwarding — reject or rewrite requests containing percent-encoded slashes (%2F, %5C), double-encoded characters, or dot-segment sequences targeting plugin channel paths.
Network control: restrict plugin channel API endpoints to known internal CIDR ranges where architecturally feasible.
Detection: audit web access logs for requests to plugin channel routes containing percent-encoded path characters returning 2xx status codes — these represent successful bypass candidates.
Rotate any API tokens, credentials, or secrets accessible via plugin channel tool configurations as a precautionary measure.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0084.001 - Tool Definitions AML.T0107 - Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Clause 6.1.2 - Information security risk assessment for AI systems

NIST AI RMF

MEASURE-2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-32031?

OpenClaw versions prior to 2026.2.26 contain an authentication bypass in the plugin channel gateway caused by a path canonicalization mismatch between the route guard and plugin handler — an unauthenticated network attacker can reach protected plugin APIs by sending requests with alternative path encodings such as percent-encoded slashes or dot-segment variants. Despite a medium CVSS of 4.8, this CVE sits in the top 91st EPSS percentile, meaning real-world exploitation attempts are substantially more probable than the base score implies. The risk is amplified by OpenClaw's documented ecosystem exposure: AIID incident #1368 confirmed the same plugin infrastructure was actively abused in early 2026 to deliver credential-stealing malware, establishing clear adversarial interest in this attack surface. Teams running OpenClaw should prioritize upgrading to 2026.2.26 immediately; until patched, restrict plugin channel API endpoints at the network perimeter and audit access logs for requests containing encoded path segments targeting these routes.

Is CVE-2026-32031 actively exploited?

No confirmed active exploitation of CVE-2026-32031 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32031?

1. Patch immediately: upgrade to OpenClaw 2026.2.26 or later, which resolves the path canonicalization mismatch in the gateway guard. 2. Workaround if patching is delayed: deploy a WAF or reverse proxy rule to normalize and canonicalize URL paths before forwarding — reject or rewrite requests containing percent-encoded slashes (%2F, %5C), double-encoded characters, or dot-segment sequences targeting plugin channel paths. 3. Network control: restrict plugin channel API endpoints to known internal CIDR ranges where architecturally feasible. 4. Detection: audit web access logs for requests to plugin channel routes containing percent-encoded path characters returning 2xx status codes — these represent successful bypass candidates. 5. Rotate any API tokens, credentials, or secrets accessible via plugin channel tool configurations as a precautionary measure.

What systems are affected by CVE-2026-32031?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, plugin architectures, AI agent API gateways, multi-agent orchestration systems.

What is the CVSS score for CVE-2026-32031?

CVE-2026-32031 has a CVSS v3.1 base score of 4.8 (MEDIUM). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

agent frameworksplugin architecturesAI agent API gatewaysmulti-agent orchestration systems

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0084.001 Tool Definitions

AML.T0107 Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 6.1.2

NIST AI RMF: MEASURE-2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.26 server-http contains an authentication bypass vulnerability in gateway authentication for plugin channel endpoints due to path canonicalization mismatch between the gateway guard and plugin handler routing. Attackers can bypass authentication by sending requests with alternative path encodings to access protected plugin channel APIs without proper gateway authentication.

Exploitation Scenario

An attacker performing reconnaissance on an organization's AI agent infrastructure identifies a public-facing OpenClaw server-http instance. Rather than obtaining credentials, the attacker sends HTTP requests to protected plugin channel endpoints substituting forward slashes with %2F or inserting dot-segments in the path. The gateway authentication guard pattern-matches the raw request path and finds no match, skipping authentication entirely. The plugin handler normalizes the path via its own routing logic, correctly resolves it to the protected endpoint, and processes the request as valid. The attacker now has unauthenticated API access to plugin channel endpoints and proceeds to enumerate available agent tools, invoke tool calls to read internal data, or trigger external integrations — mirroring the credential exfiltration abuse documented in AIID #1368 but without requiring a malicious plugin to first be installed.

Weaknesses (CWE)

CWE-288 Authentication Bypass Using an Alternate Path or Channel

CWE-288 — Authentication Bypass Using an Alternate Path or Channel: The product requires authentication, but the product has an alternate path or channel that does not require authentication.

[Architecture and Design] Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE corpus.